Other prediction mechanisms (e.g., the BTB or RSB) are significantly more
complex.
An RSB misprediction can cause execution to jump to a prior (and possibly stale)
return site [1]}, [2]}, while a BTB misprediction can send execution nearly anywhere
in the program [3]}.Including, on x86-family processors, into the middle of an instruction [4]}.
Capturing these behaviors in a semantics is possible, but the resulting
analysis is not practical or useful; in practice, developers need to make
tradeoffs.
For example, the semantics in [5]} can express all
of the aforementioned variants of Spectre, but their analysis tool Pitchfork
only detects PHT- and STL-based vulnerabilities.
